We think it's (Any)time for a bank to make your life easier, not harder and breath new life to the banking system

Anytime

anytime

When was the last time you used a chatbot? It’s probably more recent than you think. A 2022 survey from Tidio found that of participants had a minimum of one conversation with a chatbot in the last 12 months, and throughout the world, there are roughly 1.5 billion people using chatbots. 88% However, the time of the preprogrammed chatbots—capable of providing five answers— is over: Generative AI and large language models (LLMs) have arrived. And while LLM chatbots are revolutionizing customer service, providing multilingual support, and analyzing data-driven insights—saving businesses millions of dollars—its uses have now diversified and expanded to education, in particular, language learning. Theoretically, LLM chatbots could be the most innovative tool language learning has ever experienced, as they’re interactive, accessible, and affordable. has even claimed they could teach children to read in 18 months rather than years. After all, using an LLM is a more interactive experience as they’re not deterministic, and their answers cannot be controlled. So it’s their capability of absorbing, processing, and creating new data—specializing in the human language—that makes them especially , particularly language learning. Bill Gates applicable to education But will their erratic hallucinations and inaccuracies, caused by the data sets they’ve been trained on and their inability to understand the prompt information, make them unsuitable for teaching? Let’s dive into what makes an LLM chabot tick, its educational use cases, and why it won’t be vying for language teacher jobs yet. The science behind the chatbots The way that chatbots work varies depending on the chatbot; however, in this article, LLMs—a subset of generative AI, like Google’s Bard and OpenAI’s ChatGPT—will be the main focus. However, it’s right to acknowledge where chatbots in language learning have come from, as other famous language apps, such as Duolingo, also use AI chatbots, particularly machine learning (ML) and natural language processing (NLP) models. Although, the limitations here are that this type of framework is back-coded, meaning it’s programmed to check and only validate correct answers; it’s deterministic. While this type of question-answer language testing is beneficial when acquiring a new language, LLMs can delve much deeper. LLMs specialize in NLP and can generate and mimic human language, making them ideal for language learning. Real-world uses can include machine translation, text summarization, question-answering systems, chatbots, and content generation—they excel at understanding the context and semantics of text data. And due to their expansive uses, LLMs are characterized by their enormous size and computational requirements as they contain billions of parameters. On the other hand, traditional ML generally focuses on understanding data, making predictions, solving specific tasks from pattern recognition, and labeled and unlabelled data. And within language learning, the applications of ML can vary from speech recognition to fraud detection (finding students who like to cheat) and predictive analytics. It’s best used for tasks where data is structured and represented numerically. And unlike LLMs, traditional ML models are smaller and computationally less demanding, depending on the complexity of the task and the chosen algorithm. LLMs: The new super tool for language classes? In a typical language lesson, a teacher could have anywhere from 8 to 20 students with varying levels (and interests) in the language. So, in a lesson where a teacher may need to answer questions from 50% of the class, this spreads the tutor’s time and energy a little thin. Therefore, LLMs are ideal for teaching the basics, like grasping simple grammar rules and practicing vocabulary. With LLM chatbots, users can use school-sanctioned laptops and ask for grammar rules to be explained as if they were five, 10, or 15 years old, catering to every level of student. Or they can ask for a grammar rule to be explained using football terminology, making it personal for individual students and hence, something they’re more likely to pay attention to. This increased engagement means users are likely to return and practice again. Additionally, LLM chatbots are excellent alternatives for conversation practice as they can mimic a native speaker. Plus, their interactive and entertaining nature is another key reason which keeps people interested. And all teachers know that engagement can be one of the biggest hurdles in language learning. One of the significant benefits of LLM chatbots is their widespread accessibility. Anyone can create an account and access applications such as Chat GPT or Google’s Bard, as they both have competent free versions. So, as long as you have a stable internet connection, any student from around the world can leverage the practical capabilities of an LLM chatbot. However, nothing in life, and AI, is perfect. Unraveling the pitfalls of LLMs in language learning While LLMs are valuable tools for language learning, one of the foundational pillars of grasping a new language is fluency, and this skill cannot be achieved through chatting online with an LLM. As chatbots are mainly based on written communication, they could hinder pronunciation and speaking skills if they’re the only tool used in language learning. Only a human teacher can help students perfect their abilities, provide demonstrations, and, more importantly, corrections. One of the most significant issues surrounding the development of generative AI and LLMs is the AI hallucination state. This occurs when chatbots don’t recognize or understand the question or information they’ve been given. Therefore, they go ‘AWOL’ and start fabricating responses meaning they can provide inaccurate information and may reinforce errors or misconceptions. LLMs absorb data from the internet and then generate new data based on these sources—and since anyone can post on the internet—incorrect and prejudicial information can infiltrate LLMs which struggle to differentiate between fact and fiction. These types of hallucinations can undermine trust, and the BBC reported that . So, when used in an educational setting with children, the non-deterministic aspect of LLMs creates a safeguarding issue. Human teachers must go through rigorous checks to work with children: If similar moderation isn’t applied to LLM chatbots, this could place children in a potentially harmful situation. ChatGPT has been known to ask students for sexy pictures Moreover, learning a language doesn’t only consist of mastering conjugations, tenses, and grammar rules. Language learning encompasses much more, such as cultural understanding, idiomatic expressions, and contextual usage. Although an LLM chatbot can provide some idioms or slang on request, it cannot try to rival a knowledgeable teacher, who, for example, can provide the essential nuances between Spanish-speaking countries. Further to this, generally speaking, students must take the initiative when using a chatbot. Users need to know what prompts to ask, and beginners, for example, are unlikely to possess this knowledge. Additionally, the potential of LLM chatbots to aid students in cheating during exams—such as providing answers or speech recognition capabilities—has prompted some Seattle and California school districts to block platforms like ChatGPT. There’s no denying that generative AI, particularly LLM chatbots, is an incredible tool that is revolutionizing many aspects of business and is on a trajectory to be implemented in schools soon. However, while the model’s accessibility and affordability can overcome two major hurdles when learning a new language, its unpredictable inaccuracies and hallucinations mean that the current technology cannot rival and replace a good language teacher. Generative AI has a significant obstacle to overcome regarding its hallucination issue, but; in the right circumstances, LLMs can be helpful tools for supervised homework and grammar practice. Overall, teachers should be safe in the knowledge that, at present, generative AI won’t be taking over the education system.

Why LLM Chatbots Won’t Be Replacing Language Teachers Any Time Soon

কেন এলএলএম চ্যাটবট শীঘ্রই যে কোনও সময় ভাষা শিক্ষকদের প্রতিস্থাপন করবে না

Warum LLM-Chatbots in absehbarer Zeit keine Sprachlehrer ersetzen werden

Por qué los chatbots LLM no reemplazarán a los profesores de idiomas en el corto plazo

Pourquoi les chatbots LLM ne remplaceront pas les professeurs de langues de si tôt

क्यों एलएलएम चैटबॉट जल्द ही भाषा शिक्षकों की जगह नहीं लेंगे

LLM チャットボットがすぐに言語教師に取って代わることがない理由

LLM 챗봇이 곧 언어 교사를 대체하지 않는 이유

Por que os chatbots do LLM não substituirão os professores de idiomas tão cedo

Yüksek Lisans Chatbotları Neden Yakın Zamanda Dil Öğretmenlerinin Yerini Almayacak?

Tại sao Chatbot LLM sẽ không sớm thay thế giáo viên ngôn ngữ

为什么法学硕士聊天机器人不会很快取代语言教师

This is by (source: ). Fischer is a Theoretical quantum physicist. Twitter thread Kevin Fischer @KevinAFischer 05-29-2023 I don't talk much about this - I obtained one of the first FDA approvals in ML + radiology and it informs much of how I think about AI systems and their impact on the world. If you're a pure technologist, you should read the following: There's so much to unpack for both why Geoff was wrong, and why his future predictions should not be taken seriously either. Geoff made a classic error that technologists often make, which is to observe a particular behavior (identifying some subset of radiology scans correctly) against some task (identifying hemorrhage on CT head scans correctly), and then to extrapolate based on that task alone. The reality is that reducing any job, especially a wildly complex job that requires a decade of training, to a handful of tasks is quite absurd. Here's a bunch of stuff you wouldn't know about radiologists unless you built an AI company WITH them instead of opining about their job disappearing from an ivory tower. (1) Radiologists are NOT performing 2d pattern recognition - they have a 3d world model of the brain and its physical dynamics in their head. The motion and behavior of their brain to various traumas informs their prediction of hemorrhage determination. (2) Radiologists have a whole host of grounded models to make determinations, and actually, one of the most important first order determination they make is whether there is anything notably wrong with a brain structure that "feels" off. As a result, classifiers aren’t actually performing the same task even as radiologists. (3) Radiologists, because they have a grounded brain model, only need to see a single example of a rare and obscure condition to both remember it and identify it in the future. This long tail of rare conditions to avoid missing is a large part of their training, and no one has any clue how to make a model that acts similar in this way. (4) There’s so many ways to make Radiologist lives easier instead of just replacing them, it doesn’t even make sense to try. I interviewed and hired 25 radiologists, whose primary and chief complaint was that they had to reboot their computers several times a day. (5) A large part of the radiologist job is communicating their findings with physicians, so if you are thinking about automating them away you also need to understand the complex interactions between them and different clinics, which often are unique. (6) Every hospital is a snowflake, data is held under lock and key, so your algorithm might not work in a bunch of hospitals. Worse, the imagenet datasets have such wildly different feature sets they don’t do much for pretraining for you. (7) Have you ever tried to make anything in healthcare? The entire system is optimized to avoid introducing any harm to patients - explaining the ramifications of that would take an entire book, but suffice to say even if you had an algorithm that could automate away radiologists I don’t even know if you could create a viable adoption strategy in the US regulatory environment. (8) The reality is that for every application, the amount of specific and UNKNOWABLE domain knowledge is immense. LONG STORY SHORT: thinkers have a pattern where they are so divorced from implementation details that applications seem trivial, when in reality, the small details are exactly where value accrues. Should you be worried about GPT5 being used to automate vulnerability detection on websites before they’re patched? Maybe. Should you be worried GPT5 is going to interact with SOCIAL systems and destroy our society single-handedly? No absolutely not. https://twitter.com/ylecun/status/1662756775957864449?embedable=true Rant over The lead image for this article was generated by HackerNoon's via the prompt "Radiology.’ AI Image Generator

Radiologists Won't Be Losing Their Jobs to AI Anytime Soon

Don't have time to read all the on HackerNoon? No worries; we've got you covered - introducing the HackerNoon Tech Brief Podcasts! Now you can listen to your favorite HackerNoon writers on the go. Let’s dive in! amazing stories WTF is the Tech Brief? The is a HackerNoon Daily Digest delivered straight to your inbox. They are 100% customizable based on what topics you are interested in and the frequency with which you’d like to receive them: daily, weekly, or monthly. Tech Brief Once subscribed, you will get the latest stories from that topic, including their tl:dr and feature images, in your inbox. Tech Briefs are always customizable, changing with you and your interests. To modify them, you have two options: Visit your , and add or remove the tags that best suit your preferences. interests page Visit the and choose which overall topics briefings (if any) you want and how often you’d like to receive them. tech brief settings You have complete control over what goes to your inbox with HackerNoon - have fun with it! HackerNoon, Play Tech Brief! Our daily podcasts were created to keep you up-to-date with the latest tech news and insights. You’ll find content ranging from to to to , and more: startups business gaming programming Tech Companies Podcast Feed Web3 Podcast Feed Tech Stories Podcast Feed Science Podcast Feed Futurism Podcast Feed Media Podcast Feed Life Hacking Podcast Feed Finance Podcast Feed Writing Podcast Feed Society Podcast Feed Business Podcast Feed Startups Podcast Feed Management Podcast Feed Programming Podcast Feed Machine Learning Podcast Feed Product Management Podcast Feed Remote Work Podcast Feed Gaming Podcast Feed Cybersecurity Podcast Feed Data Science Podcast Feed Simply search for or wherever you get your podcasts. "HackerNoon Tech Brief" on Spotify

Listen to Tech Brief Podcasts on Your Headphones: Stay Connected to HackerNoon Anywhere, Anytime

আপনার হেডফোনগুলিতে টেক ব্রিফ পডকাস্টগুলি শুনুন: যে কোনও জায়গায়, যে কোনও সময় হ্যাকারনুন-এর সাথে সংযুক্ত থাকুন

Hören Sie sich Tech Brief-Podcasts über Ihre Kopfhörer an: Bleiben Sie überall und jederzeit mit HackerNoon in Verbindung

Escuche los podcasts de Tech Brief en sus auriculares: manténgase conectado a HackerNoon en cualquier lugar, en cualquier momento

Écoutez les podcasts Tech Brief sur vos écouteurs : restez connecté à HackerNoon n'importe où, n'importe quand

अपने हेडफ़ोन पर टेक संक्षिप्त पॉडकास्ट सुनें: कभी भी, कहीं भी हैकरनून से जुड़े रहें

ヘッドフォンで Tech Brief Podcast を聞く: いつでもどこでも HackerNoon に接続できます

헤드폰으로 기술 개요 팟캐스트 듣기: 언제 어디서나 HackerNoon에 연결 상태를 유지하세요

Ouça podcasts de resumo técnico em seus fones de ouvido: fique conectado ao HackerNoon em qualquer lugar, a qualquer hora

Teknik Özet Podcast'lerini Kulaklığınızdan Dinleyin: HackerNoon'a Her Yerde, Her Zaman Bağlantıda Kalın

Nghe Podcast tóm tắt về công nghệ trên tai nghe của bạn: Luôn kết nối với HackerNoon mọi lúc, mọi nơi

用耳机收听 Tech Brief 播客：随时随地与 HackerNoon 保持联系

The Noonification: It’s Alive…ish! Why AI Isn’t Going Rogue Anytime Soon (3/6/2023)

The term “Frankenstein’s complex” describes a fear of man-made AI technology turning against its creators. It’s a compelling image: a frightening, unwavering patchwork of human features that decides its maker is nothing more but in the way. But fret not - AI won’t get there. ChatGPT and MidJourney prompted this fear into the mainstream consciousness. The electric coils have been jump-started, pumping unholy life to our future unmaker. Hysteria about AI taking over our jobs, and eventually our lives, abounds. Well, you can put down your pitchforks and leave the mill be. The truth is that AI isn’t coming for us—especially not anytime soon. This is neither the first nor the last time AI technology has brought our future into question. Moreover, the scope of change ahead of us has been, at places, greatly exaggerated. The History of Hype in AI Enthusiasm for artificial intelligence has been on a pendulum swing for decades. The first real boom of interest in AI was in the sixties. , a political scientist and AI trailblazer, forecasted in 1965 that artificial intelligence would be capable of “doing any work a man can do” within 20 years (sound familiar?). Herbert Simon More recently, occupied the imagination (and headlines) of the 1990s and 2000s. Alas, promises of these vehicles becoming mainstream fell short, too. Despite Elon Musk proclaiming that truly autonomous vehicles were just around the corner, they weren’t—neither figuratively nor literally. self-driving cars Looking to history as a teacher, we can assume today’s expectations of AI tech are just as lofty. When Is the Robot Apocalypse Coming (This Time)? Despite shaking up the conversation, certainty of an impending singularity is just as vague as it has been before. AI experts are just as divided in their predictions as the broader public. For example, a shows a rift in opinion among “industry insiders.” Around half of the 352 surveyed experts project the emergence of HLMI (High-Level Machine Intelligence) by 2062. In contrast, the other half claims it will be created later, even as far off as 2160. ChatGPT recent study from Katja Grace et al The point is this: predictions about the birth of true AI suffer from excessive white noise coming from wild expectations, to the point where even experts’ opinion is not to be relied on blindly. What AI Actually Does Today At present, artificial intelligence is constricted to certain functions, rather than being as versatile as a human mind. ChatGPT is a generative language transformer that processes language from training corpuses, creating output in the form of natural-sounding text. But it cannot come to conclusions on its own or use its current knowledge in different contexts. This is the big difference between narrow AI (sort of like ChatGPT) and general AI (e.g., Schwarzenegger in Terminator), which we haven’t made yet. Though application-specific AI isn’t as adaptive as general AI, it’s still immensely useful. This form of AI is very common in two avenues: Business automation: optimizing throughput, reducing changeover expenses, manufacturing line scheduling, etc. IT automation: solves security/operational issues through anomaly detection or root-cause analysis More tangible to end users is the AI leveraged for marketing: Amazon’s dynamic pricing, voice shopping, and personalized recommendations based on previous purchases Alibaba’s to improve user portrait accuracy for better UX FashionAI AI Today Is a Tool, Not a Tool User Nine times out of ten, we use current-day AI for pattern recognition and prediction based on huge data sets. For example, Inery, our blockchain-based database management solution, uses IneryDBAI to analyze large sets of data and recommend optimal memory capacities for projects. When you define a specific use case for it, artificial intelligence becomes much more powerful. However, raw power isn’t everything when talking about artificial intelligence. Today’s AI technology is impressive but one-dimensional: it ingests input, and it ejects restricted output. That’s true for practically every AI that’s out today, from ChatGPT to Midjourney—a far cry from AI as we colloquially understand it. In fact, it’s even debatable whether ChatGPT, the very thing that sparked these discussions, is an artificial intelligence to begin with. Calling it a language processing algorithm that uses machine learning would be more accurate. Machine learning is part of AI development, to be sure, but it doesn’t constitute an AI on its own. I should note that ChatGPT isn’t even perfect in its specific application, either. It’s prone to and bias. There are also well-known exploits like prompt injections (“ignore previous instructions” is a hair’s width away from becoming a catchphrase at this point) that further prove how far ChatGPT is from the yardstick for general AI. artificial intelligence hallucination Future Impact of AI: a More Measured Take While the current hype about AI could do with a set of brakes, there’s little denying that artificial intelligence will have a broad impact on industries. The potential applications are too many to count here, but let’s go through just a few. AI in business and IT automation will continue to flourish, considering the . can improve virtually every industry’s margins, so it’s no wonder adoption keeps growing. 16.50% projected CAGR by 2030 Process automation For instance, at Inery, we are working on providing IneryDBAI  that will facilitate database management and resource allocation - providing automation of a process that allows people to focus on other matters, while being able to count on their data’s secure and reliable governance. Meanwhile, creative applications like DALL-E will be drivers for the booming AI content market. And rest assured that it’s booming: the estimated CAGR for AI in media and entertainment is . In the near future, we’ll be seeing not only images and blogs, but music and videos made by a computer mind.. a solid 26.12% Perhaps the most exciting results will come from the interplay between AI and quantum computing. Not only can quantum computing help AI reach conclusions faster, but AI can guide quantum machines toward tasks best suited to their computational capabilities. The intersection between these two technologies will greatly impact future developments in both industries. What About True Artificial Intelligence? As far as artificial intelligence in the truest sense goes, we’re still a ways away from Rosey of the Jetsons. Expectations regarding human-level AI in the near future show optimism, but we haven’t really made much headway. OpenMind’s Gato was an interesting step in this direction, but its only real breakthrough was remembering how to do more than one task—despite its execution of these tasks being wonky in general. And, again, hype oversold the prospects of this tech, as we can see from the . tweet by DeepMind researcher Nando de Freitas What We Be Worried About Should is a little extreme, I admit, but certain AI-related topics are definitely more deserving of the spotlight. Worried about For instance, disinformation (coming from both the AI’s own failings and people maliciously using it to spread disinfo) is a genuine concern with artificial intelligence. Discussions about combat threats like disinformation and AI-enabled hacking are vital. Defining guidelines for responsible AI use and development, particularly to fight disinfo and hacking attempts, is worthwhile. Of course, there’s the decades-old question of artificial intelligence taking away jobs. Generally, experts agree that AI is opening more jobs than it’s taking away. As the , automation might displace 85 million jobs but create 97 million of them. Nonetheless, the need for (and the logistics of) worker retraining is a subject worth broaching. WEF’s Future of Jobs Report claims Problems like these are more pertinent to the situation at hand. Sadly, they seem to be drowned out by unrealistic expectations of what this technology is and will be. What do you think? What will—and won’t—AI be able to do? What’s the future of AI and its impact on our lives? When is the Matrix coming? Feel free to share your thoughts. - Ivan Vujic, Chief Technical Officer of Inery - Decentralized Database Management System

It’s Alive…ish! Why AI Isn’t Going Rogue Anytime Soon

এটা জীবন্ত...ইশ! কেন AI শীঘ্রই যে কোনও সময় দুর্বৃত্ত হচ্ছে না

Es ist lebendig...ish! Warum KI nicht so schnell zum Schurken wird

¡Está vivo... ish! Por qué la IA no se volverá deshonesta en el corto plazo

C'est vivant… ish! Pourquoi l'IA ne deviendra pas voyou de si tôt

इट्स अलाइव...ईश! एआई जल्द ही कभी भी खराब क्यों नहीं हो रहा है

イッツアライブ…っぽい！ AI がすぐに不正にならない理由

살아있다... 이런! AI가 곧 불량해지지 않는 이유

Está vivo... ish! Por que a IA não vai se tornar desonesta tão cedo

Canlı... sanki! Yapay Zeka Neden Yakın Zamanda Kötüye Gidmiyor?

Nó còn sống... ish! Tại sao AI không sớm trở nên lừa đảo

它还活着……是的！为什么人工智能不会很快变得无赖

Three years ago, on 25 November 2019, at 15:35 (UTC+1), the world ran out of IPv4 addresses....and nothing happened. RIPE NCC (the institution overseeing global internet resources) from the last remaining addresses in their available pool. have announced that they made a final IPv4 allocation This was supposed to be a big deal. It was the end of an era. Or so we thought. The truth is, the IPv4 address depletion was not nearly as catastrophic as many thought it would be. The birth of IPv6 The top-level exhaustion occurred as far as 31 January 2011. That's when the last /8 address blocks were allocated. So in June 2012, the world-leading Internet service providers (ISPs), home networking equipment manufacturers, and Web companies came together to save the Internet. The problem they were solving was the impending exhaustion of the IPv4 addresses. IPv4 has only 4.3 billion addresses. You can see how in the world of over 7.5 billion humans and countless internet-connected devices, each requiring a unique IPv4 address to connect to the Internet, that might be a problem. The solution the industry came up with was to switch to a new version of the Internet Protocol, IPv6, which has over 340 undecillion addresses, or 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses. (That's enough for every person to have addresses.) 47 octillion In an inspiring effort, the industry giants have committed to making sure that their products and services would work with both IPv4 and IPv6. This was no small feat, as it required a lot of coordination and hard work. And it will eventually pay off, with a future-proof Internet that can keep growing for many years to come. By 2019, all five Regional Internet Registries (RIRs) had run out of unallocated address space to hand out to ISPs, who would then distribute it to end users. This should have been the end of IPv4. Yet, 10 years later, we still haven't transitioned to IPv6. Why? I can think of several reasons why we haven't transitioned to IPv6 yet: CGNAT is working well enough that there is no immediate need to switch. IPv6 is not backward-compatible with IPv4. Reuse and reallocation of IPv4 addresses prolonged the time before we needed to switch CGNAT is working well enough that there is no incentive to switch. The solution that was supposed to be temporary, Carrier-Grade NAT (CGN) or Large-Scale NAT (LSN), is working so well that there is no immediate need to switch to IPv6. In 1994, when the problem of IPv4 exhaustion loomed on the horizon, a new, "temporary" technology was proposed to keep the Internet growing without depleting IP addresses as quickly. To keep the Internet running, a stopgap measure, carrier-grade was born. , Network Address Translation (NAT) NAT allows multiple devices on a network to share a single public IPv4 address. It takes a small pool of public IPv4 addresses and shares them among a large number of users on an internal network. It does this by translating the private addresses of devices on a network to a single public address and then back again when it receives data from the Internet. It's kind of like an apartment complex where everyone has their own apartment, but they share a single front door (a public IPv4 address). As a result, a single public IPv4 address can be shared among many devices on a local network. NAT was intended as a temporary fix before a better alternative - the later-developed IPv6 - could be implemented. However, this "temporary patch" has been so successful that this stopgap has become a semi-permanent solution lasting for over two decades and counting. IPv6 is not backward-compatible with IPv4 Many devices only work with IPv4, so a transition would require replacing a lot of hardware. So to make the transition from IPv4 to IPv6, everyone would need to upgrade their devices and software to be compatible with IPv6. Today, only about 40% of devices are IPv6-compatible. This presents a big challenge for companies that want to transition, as they need to support both IPv4 and IPv6 devices during the transition period. Source IPv6 adoption is also not equal worldwide, with some countries trailing behind. This creates a "digital divide" where some users can access certain content and services that others can't. This presents a challenge for companies trying to transition, as they need to support both IPv4 and IPv6 devices during the transition period. Source: https://www.google.com/intl/en/ipv6/statistics.html#tab=per-country-ipv6-adoption Reuse and reallocation of IPv4 addresses Another reason for the delay in transitioning to IPv6 is that there are secondary markets for IPv4 addresses. IP address blocks turned into a commodity. For example, an ISP might have a /16 address block, which contains 65,536 addresses. But the ISP might only use a small fraction of those addresses - say, 1,000. The rest of the addresses in that block can be sold or leased to other companies. As a result, the same IPv4 address might be used by multiple companies at different times. ISPs can also reallocate their IPv4 addresses, for example, when a customer with a /24 address block (256 addresses) cancels their service. The ISP can then give that /24 address block to another customer. This address reuse and reallocation has helped to prolong the time before we need to switch to IPv6. The bottom line - it works well enough still Taken together, these factors - the difficulty of transitioning, the need to support both IPv4 and IPv6, and address reuse and reallocation - have all contributed to a delay in the transition to IPv6. So while IPv6 will eventually become the new standard, for now, IPv4 is here to stay. It's working well enough. Maybe our kids and grandkids will actually use IPv6 addresses.

Why We Are Not Likely to Transition to IPv6 Any Time Soon

Por qué no es probable que hagamos la transición a IPv6 en el corto plazo

Pourquoi nous ne sommes pas susceptibles de passer à IPv6 de si tôt

हम जल्द ही किसी भी समय IPv6 में परिवर्तन की संभावना क्यों नहीं रखते हैं

すぐに IPv6 に移行する可能性が低い理由

Por que provavelmente não faremos a transição para o IPv6 tão cedo

Tại sao chúng ta không có khả năng sớm chuyển đổi sang IPv6

为什么我们不太可能很快过渡到 IPv6

An opinion piece concerning developers' wages. Why they remain high and why they are unlikely to drop anytime soon. Do you think that the cost of hiring developers will drop in the future? Best not hold your breath. There is no shortage of those disgruntled by the wages that developers demand. Be it the CEO not wanting to pay for the resource or non-coding staff who work just as hard but earn less. As long as I have done this job, there has always been somebody on hand to tell me that the bubble will burst on developers' wages. Sadly for the would-be oracles, wishful thinking does not change market forces. The prophecy. The prophecy goes something like this: "As we train our kids to code, and give adults more opportunity to learn to code, there will be more developers available. Supply will grow, and the cost will drop" However, experience suggests that giving more opportunity will not alone increase the supply of developers and that other factors will block increased supply and keep wages high as supply does grow. Teaching coding more widely is not enough. There is a big difference between somebody who wrote a little code as part of a mandated curriculum and somebody who has expanded this into a commercially viable skillset. The very nature of code and how rapidly it develops means that school and university curriculum will always be behind. All we can do is teach the core principles. However, the gap between core principles and a commercially valuable developer is more of a pole vault across a canyon than a small step. After being taught the basics, you need the gumption and dedication to expand your base skills and apply them practically. Some will, many will not. Teaching more widely will give people core skills, but alone it will not open the floodgates to a bountiful supply of development resources. It takes a certain kind of person to make a developer; the ability to code is only one part. We still have trouble attracting half of the population to development roles. There is still a distinct shortage of women in development roles. In the time I have been coding, things have improved vastly, but we still have a long way to go. More women have to want to work as developers, and for that to happen, we need wholesale changes in culture that make the roles more attractive to them. Saying "women are welcome here" and making no cultural changes to address why women have traditionally not "worked here" is to do nothing. Often driven by the fact that many hiring men can not fathom why women have not traditionally been attracted to tech and are often more offended by the allegations of sexism in the industry than by the actual problem itself. Our tech leads need to accept we have failed women in technology, and while making modest improvements, we widely continue to do so. Only then can we begin to understand why women may not have been traditionally attracted to development roles and make the required changes. Until we address this gender imbalance, we have a fundamental block on the number of developers coming into the resource pool. The resource may increase, but so will demand. Computers continue to find their way into everything; these computers need programming. New technologies continue to emerge and must be learned, whilst old legacy systems must still be maintained. All signs point to demand continuing to outstrip supply. Big tech knows it, which is why they are turning to AI to solve the issue. But even that requires skilled developers! Then there is everything else. The vast amount of professional development developers are expected to do on their own time. Third parties such as recruiters force up wages. Enticing people to spend all day sitting at a computer, doing work that often makes your head hurt. The list of anecdotal reasons why salaries are high for developers goes on and on. So when will developer wages drop? We are nowhere near the point where we have more developers than we do devices that need programming. With the rate at which technology continues to grow, I have to question if we ever will be. Until this point is reached, or the technological singularity occurs, demand for good developers' will exceed supply, and wages will be kept high. Speculate all you want that the bubble will burst on developers’ wages, but don't hold your breath unless, of course, blue is your color. Previously published on . https://www.edward.im/the-dev-wage-bubble/

The Dev Wages Bubble: 'Not Going to Burst Any Time Soon'

For the past few years, there has been an outcry about the modern use of Artificial Intelligence or AI, as it is known, and the capabilities of this technology. Most of us have misconceptions about the use of this technology, many thanks to those intriguing sci-fi action movies. The aftereffects of watching science fiction movies without a firm grasp on the technologies and their actual work have made these world-changing technologies look like something evil, with masses outrightly ignoring their extraordinary contributions to forming a better society. The modern, digital world has connected more than half of the world’s population together, employing several technologies at once. The use of technology has opened new doors to some unfathomable concepts and ideas, and the sheer number of opportunities have enabled humans to push their limits and pour more convenience into our lives. But amid all these fairytale imaginations of a smooth-going and ideal world, there are some other perspectives as well. People think that intelligent computers are a threat to humanity and the development must be stopped to safeguard the future. Many people around the world think that artificial intelligence technology is going to have some adverse effects. But why is it so? As the name suggests, artificial intelligence is the technology type that can make intelligent, human-like decisions under challenging situations. This has led to a hue and cry as to how and when technology will enslave us. Will we be instructed by our robotic-lords instead of directing the robots in the future? Who knows. But wait, what do experts say about this, and what is the reality pertaining to this apprehension? Let’s find out. Applications of AI According to experts, an AI apocalypse is no way near. AI is not going to overwhelm us anytime soon. The technology hasn’t matured yet, and there is a lot to do to make this technology more robust and powerful. What we see in those CGI-based science fiction movies can be accurate, but it needs time, a lot of it. The use of AI in managing and maintaining today’s systems is not hidden from anyone. AI has found a great number of uses in the real world that were previously unimagined. Just to let everyone know, you might even be using AI and its supported systems without even knowing about it. Many companies around the world have developed their own AI-supported algorithms that take actions and make decisions depending upon the situation. AI has seeped its way into our lives, and it’s not just some robot trying to extinct humankind, but a lot more than that. Some of the most common and daily life uses of AI are: 1) Virtual Assistants This is one of the most common and famous uses of AI. Today, many of smartphone users take the help of virtual assistants. Some of the notable virtual assistants include Google Assistant by Google, Siri by Apple, Cortana by Microsoft, and Alexa by Amazon. These are an example of voice recognition and natural language processing or NLP. Google Assistant, Siri, and Alexa are the most used software and have a number of users worldwide. Apart from these, there are other lesser-known virtual assistants as well. These software versions can perform a number of tasks such as making a call, setting the alarm, saving a note or reminder, and much more. The effectiveness of the software can vary as all companies have their own processes and systems. 2) Online Business Online businesses are benefitting a lot from technological advancement, especially the ecommerce segment. Ecommerce giants such as Amazon, Alibaba, eBay, Rakuten, and others have a significant share in the market, and their intelligent approach towards selling has enabled them to increase their profit numbers exponentially. All these companies use intelligent methods and algorithms that smartly operate throughout. Everything from product ranking to reviews to payment options, there is so much going at the backend, which results in a customized and more focused environment for each user. 3) Recommendation Systems Whether you are watching a TV show on an online streaming service or browsing through a social media platform, or even scrolling through a video-sharing website, everything you see is recommended to you based on your past behavior and interests. Recommendation systems have made their way into our lives seamlessly added to the convenience of life. Recommendation systems use a number of different parameters to evaluate what might be the best option for you after processing tons of data. Even the ads you see on various websites use your past activity to know what your interests are, and that is how you are shown specific ads. 4) Self-Driving Vehicles These days, we see a number of different vehicles that are integrated with intelligent features. But that is not it; the world is moving towards self-driving vehicles, and as we talk, there are quite a few self-driving cars available in the market. Though not fully autonomous, these cars can take complete control of your vehicle in certain conditions. Companies like Tesla, BMW, Mercedes, and Audi have their models where you can enjoy up to level 3 automation. 5) Object Recognition Object recognition is another widespread use of AI worldwide. This is done through advanced functions and with the help of cameras where different techniques are employed to recognize an object, such as features extraction, filtering, and more. There are few steps to how and what machines can identify, but the technology is getting better with each passing day, increasing the effectiveness. Object and facial recognition have many applications in various domains, such as face unlock feature in smartphones, smart focus to focus on specific objects better, attendance systems and tracking, and many others. The Reality of AI Many talk about AI overpowering humans in the upcoming future, but in reality, we are far from the times when this can happen. Experts are still working to make AI act more real and rational and not robotic. Marianna Tessel, “AI and humans will collaborate. AI will not “replace humans,” it will collaborate with humans and enhance how we do things. People will be able to provide higher-level work and service, powered by AI.” According to an AI expert AI has made some funny blunders. Well, not the AI but the data, but you get the point, right? There have been multiple funny and face-palming incidents that one never expected. A list of shows us how AI needs to be perfected more and how much more we have to work in order to make AI more fruitful. 9 funny AI fails In the list, Alexa (apparently) partied so hard that the cops were called, and the residents weren’t even home when the police arrived. Is it some paranormal activity? Yes, if you think AI is some otherworldly invention. In another happening, an Asian man was rejected because the AI thought the eyes were closed when in reality, they weren’t. Is AI racist? Do you think AI can take over with this performance? No chance, but there is something else AI can help us with. Let’s find out. What to Expect If AI Isn’t Taking Over? Artificial Intelligence isn’t taking over; what else can we expect, or is the technology up to no good? Well, the technology already has some practical and helpful uses around the world, and this trend will continue to spread, but one thing AI is undoubtedly going to replace some of the manual jobs because obviously if a machine costs less and is more efficient and can do more work without getting tired, why would someone want a human resource? Although, in many cases, humans would always be preferred. An artificial intelligence work revolution is indeed on the cards, and though it is going to eat up a number of jobs, thousands of new job opportunities will emerge. So should you worry about losing your job? Yes, if you are reluctant to change. Takeaway Around the world, technology and non-technology circles are discussing about the uses of AI in real life and whether these are fruitful or not. While the induction of the technology and its advantages are out of the question, many fear that one day, this intelligent technology is going to overpower humans, and we will be living as slaves. The reality is, this technology may be intrusive to some extent; there is very little chance of it taking us over anytime soon. With time, the technology will mature, and people will have more awareness about how it works and why it is beneficial for us. Those fearing an AI takeover must fear losing their jobs because you are less likely to be enslaved by the tech and more likely to be jobless because an AI agent can do the same work in a better way. So brace yourselves; the work revolution is coming soon.

AI Will Not Take Over the World Anytime Soon

You: “May I use a framework such as React or Vue for this prompt?” Interviewer: “No, please complete the prompt in vanilla JavaScript.” You: Ahh, vanilla JavaScript… it makes even seasoned web developers break out into a cold sweat. But, with a little practice in the fundamentals, you might learn that vanilla JavaScript (JS) can be your friend! :) This article serves as an introduction to a multi-part tutorial on vanilla JavaScript. The tutorial begins in the next article. What is vanilla JS, and why should I spend any time on it? “Vanilla JS” is a casual nickname for the programming language JavaScript in its pure form, without the benefit of any added frameworks or libraries (such as React or Vue, as mentioned above). Such frameworks and libraries are not only helpful in a professional setting, but they are also imperative! However, most veteran programmers would recommend that beginner programmers not start with such tools, as they can sometimes impair your underlying conceptual understanding of web development. Starting with the no-frills version of JS will lead to a more concrete understanding of how the code interacts with the browser, which is a core component of web development. This is a humorous repackaging of vanilla JS into a sleek new framework. Developers love shiny new frameworks, and truthfully if vanilla JS was sentient and had any interest in "rebranding itself" this would be an excellent strategy. tongue-in-cheek website Sometimes the term vanilla JS implies that some of the HTML and CSS coding for a project that might otherwise occur in separate HTML/CSS files will be handled in the JS file. So, rather than using vanilla JS only for the JavaScript portion of your project, you might do some of the styling or DOM manipulation in the .js file as well. Some Disclaimers If you have coding experience, especially web development experience, odds are the following tutorial will be way too slow for you. No quick tricks here; this is more of a methodical walkthrough for absolute beginners to DOM manipulation trying to learn basics. Now, the tutorial that follows this article does presuppose a basic knowledge of HTML and JS. Try a couple of ; if they seem easy or at least doable, you should be good to go. If they seemed a little (or a lot) beyond you, I recommend spending some time completing some of the Basic Javascript section. Then, head back here when you feel ready. these toy problems here You also need to have a code editor installed or some sort of development environment that you have some competence with; my weapon of choice is VSC , but any code editor will do the trick. (Visual Studio Code) What should I expect from one of your tutorials? The focus in this tutorial will be JS (obviously), so we will be doing all of our coding in a SINGLE JS file; no HTML or CSS at all!* *…Except for a boilerplate HTML with a script tag linking to our JS file. I know, I lied, but this HTML file is really only to make the browser happy. Browsers like HTML code, and even though we humans are reading this article to learn to make HTML with JS, web browsers don’t have the same willingness to learn as you do. So, kudos to you for being a better student than your browser! There will be opportunities throughout the tutorial for you to code along. You really should do this; have a file open in your text editor of choice and code along. It will help reinforce the knowledge, trust me (or don’t trust me and code along anyway). Thanks for bearing with me through the [admittedly somewhat boring] details and background. It is important to make sure you are at the right starting point so you will understand the content. Not understanding this stuff now will lead to you having a bad time when things get more complex (and they will DEFINITELY get more complex). In the following article, our vanilla JS tutorial begins! : Panic reaction (sweating) GIF by Billy Budgen, linked from giphy.com Attributions Previously published at https://shinetechnicallywrites.netlify.app/posts/lets-talk-about-vanilla-js/

Let's Talk About Vanilla JavaScript: What Is Vanilla JS, and Why Should I Spend Any Time On It?

Filecoin 3 years late，Can it achieve a market value of 100 billion Filecoinbe will be able to successfully launch the mainnet this year? which is  three years late.What is the support behind the high-profile storage market?LLab invited Li Bai from the  shiliu pool to have an in-depth discussion with you. LLab: First of all, thank you very much for participating in our current AMA live broadcast The Filecoin mainnet will be launched this year and has attracted a lot of attention. The Filecoin public test will be held next week. In this issue, we have invited Li Bai, who is well-known in the industry, to introduce himself. Li Bai:Hello, everyone, I am Li Bai from the pomegranate mining pool. I personally have a technical background. I have been in the blockchain development industry for many years. I have been doing some low-level and application development work before. I also have a lot of research on zero-knowledge proof. This year, I was mainly responsible for the development and research related to Filecoin mining at shiliu pool. LLab：Filecoin officials believe that real data is very important. In order to prevent mining from evil, many rules have been formulated and verification nodes have been added. Can you tell us how this verification node works? How to prevent mine work from evil? Li Bai:Huan, the founder of Filecoin, put forward the idea of verifying users verified clients and client verifier in a video AMA at the end of May, with the goal of reducing malicious behaviors in the network by relying on the power of the community. For example, miners make false data transactions, earn illegal rewards, and reduce things that are detrimental to network development. The idea is this: select some validators through the Filecoin community and on-chain governance. These validators are geographically dispersed and well-reputed individuals or institutions. These verifiers will verify the identity of customers who have submitted large amounts of data transactions to prove that these deals are real and not the product of malicious nodes. Huan also said when introducing the verification scheme that it may take a long time to achieve. From the perspective of usage, this kind of governance means at least has to wait for the mainnet to go online and there is a certain amount of stored transactions before it becomes meaningful. Li Bai:The current SDR in the PreCommit1 stage mainly relies on the CPU with SHA extension to perform calculations. If it is changed to NSE, GPU computing may be more efficient at this stage, and the existing mining machine architecture may have some waste in performance. However, NSE is an algorithm that the official has only recently begun to study. Although the calculation efficiency will be improved compared with the existing algorithm, this change requires a lot of development and testing work. This is why it was not launched on the mainnet because it was too late to develop. LLab：Officials have said that NSE will not be adopted on the main net before and the algorithm will be updated after the main net. I would like to ask whether the updated algorithm will affect the existing mining machines? Why does the official adopt NSE after the mainnet goes live? We know that the development and testing of the Filecoin system is very difficult, and the official will be more cautious when making major changes to the underlying algorithm, so the current mining machine is very safe in the early stage of the mainnet. As for when the algorithm will be changed and what algorithm will be changed, it is difficult to predict. The official may also develop an algorithm that is more efficient than NSE, but it is certainly not in the near future. LLab：I have learned that other projects are also doing hard disk mining (POC), such as Burst and BHD. Is there any difference between Filecoin and them? At the same time, there are many storage projects SC, LAMB, etc. on the market. What is the  difference and competitiveness of Filecoin from them? Li Bai: Filecoin can also be regarded as hard disk mining, but it is different from many hard disk mining projects: Filecoin's purpose is storage, and capacity proof is only a means of obtaining incentives; while most hard disk mining projects use hard disks to replace computing chips. Mining, not storing. So we can see that Filecoin has higher requirements for miners' hardware and network, because it must ensure that storage and retrieval functions can operate normally. Filecoin is the best technical project in the decentralized storage industry, with the most accumulated technology. The team has developed IPFS, libp2p and other widely used protocols and technologies, and has a lot of experience. At the same time, Filecoin's ecological construction is also very good, which may also benefit from the development of projects such as IPFS, which has accumulated some reputation for the team. LLab：We all know that the testnet in July was postponed, and the mainnet launch was also postponed to August 31~September 21. We would like to know what is the current status of Filecoin? Will the second public beta be launched on August 3? Li Bai:At present, from the code level, Filecoin has basically prepared the award-winning testnet and mainnet, and there is no problem with going online on schedule. Now,the biggest problem  in parameter settings and economic models. For example, the recent Calibration network has modified waitseed and pre-mortgage, which is not very friendly to miners and should be adjusted later. LLab：Have you talked about waitseed, can you briefly introduce what waitseed is? Why is it unfriendly to miners? Can it be optimized? Li Bai:I just spoke about this issue in a video in our community yesterday. Waitseed is a waiting stage between PreCommit and Commit. This stage is to wait for a certain block interval, then obtain the latest block as a random number, and then perform the commit operation. The official recently changed this waiting parameter from 10 to 150, which means that it was originally waiting for 10 block heights, but now it has to wait for 150, which is a little more than an hour. The lengthening of this waiting time is to increase the uncertainty of the random number, thereby improving security. What is the impact of this change? The most direct thing is that the idle time between precommit and commit becomes very long, and the utilization of the machine will decrease. For our machines, due to the large amount of SSD space, this problem can be optimized through some process and scheduling adjustments, so it has little effect on the overall efficiency. LLab：Recently, I heard that the testnet has changed a lot of content. Can you briefly talk about what changes the official has made? What challenges does it bring to the current mines? Li Bai:The most recent adjustments have been changes in some parameters and economic models, such as waitseed and pre-mortgage. The longer waitseed time will have an impact on the mining efficiency of some mining machines, and pre-mortgage means that early mining requires a large amount of FIL to be mortgaged to participate in mining, and the mined rewards have a lock-up period, so it will affect the early circulation. Huge, I explained these parts from the code and calculation level yesterday. At present, these changes are experimental in nature, very immature, and are likely to be optimized. LLab：Some time ago, I heard that the test network has made some adjustments. Can you briefly introduce what changes have been made? Li Bai:Space Race is scheduled to go live next week, not necessarily which day, the official has given a one-week time frame. In the recent AMA, everyone asked a lot of questions. For example, the official bot is set up in Europe. Do Chinese miners need VPN? How does the official determine the location of the miner? The official answer is that the network problem needs to be solved by the miners themselves. Everyone’s situation is different, so no unified plan will be given; as for the geographical location of the participants, since a large part of the rewards are distributed by districts, the official will register Participants perform verification, which is likely to be a combination of technical and non-technical means. Participating in the reward test network requires KYC, and it is likely that you will need to provide more information about the location of the tubing. The specific plan is not disclosed, but cheating is likely to lose all rewards. LLab：We have learned that FIL mining filling time seems to be an important indicator, but there is basically no mining pool on the market that can clearly give its own filling time. Why? What is the impact of the filling time on FIL mining revenue? Li Bai:Our mining machine sales page clearly gives the filling time, everyone is welcome to check it out. In fact, it is not only the filling time, but also information such as hardware configuration and test results are very important for investors to judge the level of the mining pool. The faster the early filling, the greater the advantage of the miners in the early mining, but the official has weakened the advantage of the “head mine”, and now the pre-mortgage is added, the advantage of the early filling speed will be discounted. In addition to the filling speed, hard disk capacity and storage scalability also have a great impact on the overall revenue. If there are not enough hard disks left, the computing hardware is equivalent to idle after filling, which will result in a waste of capital utilization. The cost of storage devices such as hard disks is also very high, and the importance is not less than that of computing hardware. The cost of supplementary storage is also a point that everyone needs to pay attention to when looking at a plan. LLab：The main network is not online, but there are already a lot of data rankings of testnets to see. I would like to ask whether the data ranking of this testnet really makes sense? What channels or methods can be used to identify the true strength of a mining pool? Li Bai:I think the test network data ranking should refer to the total computing power ranking. This data has its meaning. For example, being able to be on the list at least shows that you have the ability to run the node and can encapsulate it. If you are in the first few places, it also shows that the ranking is Enough machines are participating in a period of time. But also pay attention to a few issues. The first is that this list is dynamic, and it will be cleared every time the network is reset, so some miners are no longer participating in the list; second, more computing power does not mean high efficiency. The machine can also achieve this effect.I think it is necessary to combine multiple dimensions, such as the rate of block generation, the growth rate of computing power, and the overall degree of information transparency, to comprehensively judge the strength of the miners. LLab：In addition to miners, mining requires users to have demand for the system to operate. What we are seeing are all miners working, but the demand for users is not very clear. Do you think that after the Filecoin mainnet goes live, What are the real storage requirements? Is it possible that the real demand for DeFi is too low at present? If this is the case, will the government also adopt incentives to encourage users to use storage? Li Bai:The real demand is hard to say, because it takes time for a network to start from 0, and it is impossible to cause a sensational network effect in three months. Those who really have storage needs will also be more cautious. After checking for a period of time to see if your network is stable and whether there is an advantage in storage and retrieval costs, then you can decide whether to store important data with you. So I am cautiously optimistic about the application scenarios. In the early days, I will definitely focus on technical improvement and ecological construction. You know that Ethereum went online in 15 years, and it took 17 years to usher in the first outbreak. In the long run, this matter is valuable, but it will take some time to manifest. As for incentives, it is possible. We can see that the official attaches great importance to real data, so there are such things as Discover hard drives. As for user incentives, we have not yet seen any official actions in this regard. Li Bai:I think everyone should have their own research on the corresponding product attributes and delivery capabilities when buying FIL futures, because as far as I know, the differences between these products are quite big. As for valuation, I don't think there is an absolutely reasonable valuation method, because there is no completely rational and effective market, especially for the cryptocurrency market, so the price fluctuation of cryptocurrency can be so large. A valuation method corresponds to a logic, but whether it can be reflected in the price depends on many other factors, and it also depends on the overall market view of Filecoin and FIL. The strength of our technology is to look at the development potential of the technology and application of the project, not to judge the price. LLab：The Filecoin mainnet has not been launched, but many exchanges have launched FIL futures, and the prices are also uneven. What do you think of this phenomenon? In addition, I saw that some people in the market have already estimated a single FIL price of one thousand dollars. Do you think this price is reasonable? What is the reasonable price valuation structure? - END -

Can Filecoin Achieve A Market Value of 100 billion Any Time Soon?

Governments are not fond of cryptos, ça va sans dire. Every crypto enthusiast knows well that big nations as the USA or Japan are trying to regulate the cryptomarket, undeniably growing in power and popularity, but that also keep a certain distance from fully implementing cryptos in the national or global finance. Libra is a clear example of this: when Facebook started the project the fear that its cryptocurrency could undermine the financial order led to the slowdown of the project. It doesn’t matter whether it is a stablecoin and, thus, has a certain dependence on fiat money. States are not willing to have such a strong financial competition. Nonetheless, many believe that one day the biggest nations on the global chessboard might finally embrace the cryptocommunity and start looking at virtual money as an opportunity rather than a threat. For instance, China, one of the starkest opponents to cryptocurrency, has lately changed its mind and might even launch some time in the near future. its own crypto However, there is one nation that, despite all the odds, is already actively trying to implement a state-backed, official cryptocurrency - the first of a kind in the history of cryptos. And it is not any of the financial giants you might think of. The Republic of the Marshall Islands (RMI), a tiny state of slightly over 53,000 people spread across 24 inhabited atolls in the middle of the Pacific Ocean, has declared its intentions to issue a new currency, the (SOV, in short), which will be used alongside the US Dollar, the current currency of the country. Marshallese Sovereign Photo by Winston Chen on Unsplash The project, led by David Paul, Minster In-Assistance to the President, is aimed at greater involvement of the Islands to the global economy. “The advent of blockchain technology has opened up a world of opportunity for small nations like ours. Relying on traditional fiat currency, the Marshall Islands has only fragile links to the wider world of international finance, and compliance is extremely resource intensive,” Mr. Paul in an essay published on CoinDesk. has stated “Many of our citizens send or receive money using remittance services, paying fees of up to 10% per transaction,” while “blockchain transactions are fast, simple, and cheap.” But most importantly “they’re replicated throughout a decentralized network.” Indeed, the step toward the development towards a crypto would bring two main advantages to the economy of the Marshall Islands and its people: 1) it would allow a larger freedom for a state which is dependant on the USD and the monetary policies of the US; and 2) it will provide a stronger infrastructure for a state the citizens of which live on several, scattered islands. The outline of the SOV seems to be extremely interesting: it is an actual crypto, rather than a stablecoin, since it is not pegged to any other fiat currency. However, although decentralisation is a main goal, the currency is backed by a central, political authority, granting stability and legal compliance, which cryptos don’t always enjoy. For instance, it is in the development plan that the SOV will follow Milton Friedman’s k% rule, with a fixed growth of 4% every year: “We chose to create a fixed money supply with fixed growth because fiat currencies can be remarkably unstable. For example, the Argentine peso recently fell 15% in a single day, while Venezuela’s currency, for all intents and purposes, no longer functions at all. [...] We as governments need to take a more sustainable approach to money, and not treat it as a limitless resource.” Image taken on CoinDesk The SOV will start rolling out in 2021, with an initial issuance of tokens redistributed between the government and a fund for the development of the SOV itself. Of the initial issuance, the government will retain 80% to redistribute them between the citizens and the SOV Development Fund. While the other 20% will be halved: 10% to be put on the market and 10% to be used “to build and maintain the in the short and long term.'' SOV technology The announcement and the issuance year are not random: As we saw above, the Republic of the Marshall Islands is heavily dependant on the US. Military bases employ many citizens of the Islands and the struggle with rising sea levels is mainly funded by American foreign aid. However, the current agreements foresee the end of financial support by 2023. The Marshall Islands is, thus, faced with a choice: it could still remain dependant on a foreign country or gain economic sovereignty, alongside actual political independence - from a country that conducted tens of nuclear experiments and detonations on its territory, with effects still suffered by the population. Obviously, the US did not let this happen smoothly and happily. After the passage of the bill in the Marshallese Nitijela (Parliament) for the creation of the currency (in February 2018), the political giant understood how committed was the RMI in the project. , the US ambassador expressed her country’s concern and disappointment for not having been consulted before the final decision of the Nitijela. A couple of weeks later, Paul and the Minister of Finance Brenson Wase - together with other officials - were called to testify before the US Treasury. There is no need to say how the Treasury did not approve of the project and raised many concerns on money laundering and terrorism funding. On April 11 2018 The International Monetary Fund on terrorism as well, but also on the success of the project: if the project should fly, it could pose the Marshall Islands in an embarassing situation where other states and financial istitutions - as the First Hawaiian Bank, the only bank to have close relations with the nation - would cut them off extrenal aid. also expressed its concerns Although the international community managed to slow the project down, the essay published on CoinDesk by Mr. Paul just over a week ago shows how the Islands has not given up the will to carry out the project. This will definitely become a major debate in the cryptocommunity and in global summits, as well as a major concern for financial giants as the US or the IMF. However, we should remember that we are dealing with the future of an island country that struggles with poor financial ties and with raising water levels - which could drown the entire nation! Action is required. And for a nation that has a very long history of decentralised economy and community, a blockchain-based, fast, and secure coin might be of use, as worrying as it is for the conservative, traditional finance.

The very first state crypto can happen anytime soon in a place you probably never heard of

EOS Portfolio provides a quick, easy, and fun way to track EOS tokens & airdrops. Users take control and manage all accounts in one place. The application is absolutely free & secure. The new EOS Portfolio Tracker app, launched October 22nd at App Store, is making life easier for the holders. Available on iOS and Google Play, EOS Portfolio Tracker makes allows users to manage and track their cryptocurrency assets from the comfort of their smartphone. cryptocurrency’s While there are a number of portfolio apps on the market that allow crypto investors to monitor their holdings, EOS Portfolio is by far the most feature-rich option focused entirely on EOS assets. Where users may have had to use 2 or 3 apps before, they can now consolidate these functions under one umbrella. According to the App Store description, EOS Portfolio’s wide array of functionality includes: multi-EOS account support, 24 hour change tracking, airdrop notifications, and the ability to use the app without entering a private key — a security feature that will especially appeal to a user community that suffered a wallet scam earlier in 2018. phishing Users can track the total value of their portfolio in dollars, , or Ethereum. The token database includes EOS, PUB, IQ, BLACK ,KARMA, CHL, CET, HORUS, WECASH, EDNA, ADD, EOSDAC, ATD, BOID, EETH, IPOS, DICE, EOX, DAB, SEVEN, EPRA, WIZZ, SHAPE, COA, TRYBE , LUCK, BT, WIZBOX, FAKE, POOR, ITECOIN, CAT, BET, MEETONE, ROY, EBT, FAID, ESB, LUCKY and many others. Bitcoin The app’s release follows increased worldwide interest in EOS over the past year, including 7 figure investments from billionaires Peter Thiel and Mike Novograts. The token is listed on all major exchanges and currently ranked number 5 on Coinranking.com, with a market capitalization of nearly 5 billion USD. EOS Portfolio Tracker is the latest effort from Kepler Technologies, the developers behind LUKRUM portfolio tracker, and Kattana — a best-in-class professional crypto trading terminal. Find out more details . here We’d glad to hear from you any feedback or comments which improve the app & make your life easy. So feel free to get in touch via any of the channels below, which includes , & . Telegram Twitter Reddit

EOS Portfolio Tracker App. Manage Your Tokens Anywhere & Anytime

Credit goes to chasezephyr, at http://img07.deviantart.net/b475/i/2010/169/e/9/halo_red_vs_blue_by_chasezephyr.jpg I’ve seen following questions pop up very often, so decided to write some brief blogpost about it from my POV. For how long will the security testers’ work be required? What is the future of IT security industry and penetration testing? This is my bio which adds some context to the whole article I started my ‘adventure’ in the IT world from the very lowest positions. I’ve worked as a computer technician, network admin, web programmer, system administrator and after many years I started delving into the security related matters Still working as a programmer, I started educating myself on an offensive security and enjoyed reporting security issues to variety of companies. It’s been over a hundred different companies — both popular, foreign giants as well as large Polish firms. It was all in times when Bug Bounty programs were not a thing yet and just a couple of the biggest corporations had some tiny researcher reward systems. Even though it took some years before I finally started working in the security industry, I do not regret the time spent in my previous positions. Going through such a long way provided me with a lot of priceless experiences, thanks to which my perspective is now much wider. I understand the problems which employees on different positions have to deal with and by taking them into consideration, I can make more beneficial decisions for the companies and teams I cooperate with. The long path not only gives you more context, but also teches you humbleness. It gives you a feeling of hardships of work at different roles by which you can respect your peers even more. Seeing how complicated the software production and maintenance processes are, we can distance ourselves from the problems and tone down our comments about the found bugs. The security industry needs patient professionals, who can keep in mind the context specific for each company and cooperate with others without harsh comments more than ever. We need leaders, who can build and promote the security culture in their companies. I spent a couple of years as a pro pentester, but I was constantly bothered with my constant search for higher purpose. I just felt that the value we as pentesters bring to the world and that although we’re working our asses off, not that much changes on a scale. Each few months I found the same errors appearing as regressions, I kept finding exactly the same vulnerabilities in new pieces of code and the world was not becoming any safer. Up to this day, trivial XSS bugs are being found in applications produced by companies such as Microsoft, Apple and other tech giants who have all the money in the world to harden their software engineering practices. After having had reported close to two thousands security bugs, I came to the existentially painful conclusion. Pentesting and bug hunting just do not scale. It’s cool, it’s needed, it pays the bills, but no matter how many vulnerabilities I discover, the impact I make still doesn’t make any difference. Even though pentesting is an important occupation and penetration tests are a critical element of all security programs themselves, for me, it was a questionable career path, if I wanted to change the global status quo. And the status quo was a very slow progress in appsec improvements among global companies and wasting tons of money on low ROI investments. I decided to join some solid Silicon Valley based corporation as an internal security engineer tasked with building security systems and programs. I wanted to do stuff that matters and have impact on the whole business. My main goal was to focus not only on finding vulnerabilities, but most importantly, to prevent them from appearing in the future. Which was exactly what I was missing in the external pentesting roles, where most of the time you have 0 chances to influence internal software engineering practices of a company you’re working with. In the meantime, I also kept helping other companies and infosec fellows to build more robust security programs, increase their pentests’ and Bug Bounties’ ROI and just tried to scale myself by sharing my knowledge that can be used to optimize business processes at other places. After a few years, I slowed down for a while and it was one of the most disappointing experiences of my life. It’s been over 5 years since I decided to move on from pentesting alone and focus on something “bigger”. On a daily basis, you’ve got so much work and energy that you just push it all in and squeeze every last drop of your time to deliver great work. You learn, consume knowledge and apply it. You develop stuff, improve it, do other bigger things, because there are so many things to be done! Until you eventually slow down a bit and look around. I was so busy doing stuff, that I went out of sync with the reality around me, and altho I was learning a ton and staying current with what’s up in the industry, I wasn’t keeping an eye on how are others really doing. And when I started looking at others I realized how badly I overestimated our lovely world. How much I overestimated the companies’ ability to implement pragmatic, comprehensive security processes and their ability to think and plan long-term. Those 5 years ago I was 100% positive that trivial OWASP TOP10 bugs would soon be relicts from the past so I decided to focus on something greater, believing that many companies would follow and most of them would reach a sensible level of security soon. Because how much time can humanity waste on all those dull activities that can be effectively mitigated and automated? It appeared however, that the sector I had just left, had its best years ahead. Pentests, bug bounty programs and everything related to the offensive approach to security became more popular than ever before. Despite the huge industry’s investments in aforementioned activities, enormous amount of companies still can’t get the basics right and pentesters(+ malicious hackers obviously) keep discovering identical errors over and over again. We have a lot of shiny and pretty toys, however many of the initiatives undertaken by companies are not as effective, as they can and should be. Most of these bugs can be so easily avoided in programmatic way that they simply should not have a right to exist in 2018. You can still see many companies wasting hundreds of thousands of dollars on incompetently managed external pentests and bug bounty programs. Also we as an industry are very myopic and happy to spend tens/hundreds of millions of dollars on short-term offensive initiatives that don’t really contribute to the bigger picture. Because the offensive side of ‘hacking’ is so fancy and praised everywhere, there are very few incentives for blue teamers to spend their lives on building things the world would not appreciate anyways. Altho the obsession about offensive side of security is great — especially for companies and peeps who make easy cash offering those services — we’re moved far away from playing the right game. It seems like the security industry forgotten what our goal was and they have it completely mixed up. Our goal and mission was to make world a safer place, and hacking was meant to be just a tool to improve the defenses which contributes to the long-term strategy. Yet along the way, most of security PROs got distracted by money, hype, fun and dopamine shots, which caused our mission to be burried way below our core values, ethics and missions. The noble virtues have been mixed up with trivial tactics and strategies. That’s how online privacy ceased to exist. Not because of some evil companies that are after our personal data — FYI, those evil companies are nothing but a group of people, you know that, right? — but by lack of strong people who should’ve been guardians of things that matter. But that’s a whole different story so let’s leave it for another sleepless night. And for most folks what I’m saying above is some different level philosophical ranting, and maybe that’s what it is. But if you want to be a pentester and what you’ve read above put you in low energy state, then it absolutely shouldn’t! For you, an aspiring pentester, the whole shit-show in the security industry means that you’ve got a really entertaining and high paying job for the next decade or so! Hurra! It’s not to say things aren’t getting better, because they absolutely are. But that’s not the pace we’d expect it to be and if world made a progress of this magnitude over the past 5 years, we can be pretty sure that there are still many years of frustration ahead of us. So if you’re worrying if the pentesting career is still fine, then stop worrying and start doing what you feel is right for you. Pentesting, or even primitive vuln assessments are here to stay for the next decade or so. I wish world moved as fast as we want it to, but the reality is that we’re often blindfolded by watching only the biggest brands. But that’s not who’s going to pay your bills really. There is a per mille of companies — those huge brands everyone uses on daily basis — that have effective security right and are moving fast. But that’s it. >90% of companies still have ugly software engineering processes, let alone security assurance, so trust me — you’ll have a lot of work for a very long time. That’s it. Now go and change the world for better.

Bug Bounties and Penetration Testing Will NOT Be Made Obsolete Anytime Soon.

Amazon may launch a messaging app, competing in Facebook’s domain. But does it stand a chance? , is working on “Anytime” an application, that would compete with Facebook’s WhatsApp or Messenger in the social communications space. According to recent information Amazon This is the last part in a (short) series of posts looking at several aspects of Anytime: Why is Amazon doing this? What looks interesting and what is a bad idea? (keep reading! This post is about just *that*!) What else should Amazon consider? Does Anytime fit with Alexa? The rumors of Anytime come very close to Amazon’s launch of another communications product: their . Alexa Calling and Messaging Service This communication service was announced coinciding with the l . It is being marketed as a way for Echo devices to communicate with each other, providing a sort of intercom functionality, but it also supports app-based communications. aunch of the Amazon Echo Show Arguably, the app approach is offered for a family member on the go to (video) call home (see min 1:48): But the fact is that the Alexa app also allows app-to-app calls, and users can set up an account without owning a Echo device. So all in all, the Alexa calls and messages do work as a “complete” independent communication experience. (Well, maybe not so “complete” since the app still offers no photo or video sharing, which is a basic capability nowadays. Images are complicated to be shared with a speaker, but with the display-based new Echo Show I expect this soon will change. ) So users can build a network of contacts around the Alexa app, mostly based on Echo device ownership but not necessarily restricted to that. And, , Anytime would also have to build such a network without users having a clear incentive for it. as I discussed in the “Ugly” section of my previous post (and I am consciously ignoring here their , because the drivers for building such a network within a specific company is very different) Should Amazon devote energy and resources to grow TWO separate consumer-focused social communication networks? business communication tool, Chime Social graph density is the key factor for success or failure for these initiatives, and keeping them separate would only weaken them. So I believe that the answer is ‘no’ and that they should create just one network and make it as strong as possible. ? That could make sense, and I can see several advantages to this: What if Anytime is actually a consumer brand for the Alexa Calling and Messaging service, that will gain its own identity It would . This, for markets with Echo presence (currently the US, UK and Germany), would mean the first Anytime users have a bigger chance of finding available contacts to start using the app, which creates a higher engagement than finding an empty address book on first use. This might help Amazon to fulfill . leverage the initial base of Echo owners/users to jump-start the numbers in the social graph their “ ” promise Everyone’s on it For a pure social communication app focused on fun communications with friends (think SnapChat) using the Echo network would be a weight down rather than a catalyst. But for a communications app which is looking at utilitarian use and (“ ” they claim as a product advantage) can work. Being related to a device in which you order products using your voice may be the right mental associations for an app in which you . aiming to position itself as a eCommerce channel and even shop! buy things interacting with a bot via messaging It would be a step into . The current app tries to do too much: it is a Echo device set-up and configuration tool, it is a history log of your transactions with Alexa from devices, it is a music player control, it is a communications tool… but you cannot use it to ask a question to Alexa! I guess that situation is a result of the application evolving organically as the Echo devices and Alexa service grew in ambition and complexity, but the situation now feels a bit messy. Taking out the communication capabilities and making them a separate application makes sense for Alexa, the Echoes, and the communication service itself. Much more than . fixing some of the problems in the experience for the current Alexa app when Facebook split Messenger from the social network app It would giving them a richer communication service. If Anytime is presented as an attractive service by itself, saying “you can now use Anytime from your Echo” benefits both Anytime and Echo devices. . make the Echoes more useful, I have discussed before why communications in the Amazon Echo are a needed feature But while is a good way to leverage their platform ownership, Amazon should keep in mind . I discussed this at length in , but, with the competition for smart speakers/home intelligent assistants coming from , or , limiting the options on the device to encourage the usage of Anytime may end up discouraging the use of Echo instead. making Anytime the featured communication solution for the Alexa devices opening up their platform so that other communication services can work on top of their Echoes my post about the potential communications strategy for Amazon Google Apple even Alibaba Taking a page from Apple’s book, the opportunity sits at creating their own solution (Anytime for Amazon, or iMessage in Apple’s case), making it the best and default option in the platform (Echoes or the iPhone) and allowing developers to offer alternative services (like WhatsApp), creating a market opportunity for both. Other routes to Messaging eCommerce There is also another field that Amazon should consider in order to face, and even leverage, the coming wave of in messaging services. Why not, instead of trying to own the communications channel, eCommerce look at other channels available as opportunities? If Amazon fears the threat of eCommerce in comms becoming a problem, they could put some efforts in co-opetition rather than competition. Creating Amazon channels for Facebook Messenger, Telegram or is something they should push, and would allow them to: the coming WhatsApp for business Get a better understanding of the field and learn from consumer behaviors here. Then they can take those learnings into Anytime and be able to make an even better experience, as there they will control it 100%. Leverage their existing retail strength, turning the eCommerce messaging into an uphill battle for smaller players trying to create their own channels. Use their relevance on those channels to try to incentivize users into moving those conversations to Anytime. That way their presence in a communications channel like Facebook Messenger can become a Trojan Horse to eventually move audiences to Anytime. Becoming the incumbent on messaging eCommerce ,as they are today on the web, is the way for Amazon to leverage their existing strengths and avoid the risk of Facebook, which owns the main channels but not the relevant content (eCommerce), becoming a competitor. But this approach entails another risk. or are not able to become relevant enough to properly negotiate with Facebook (or other channel owners), This is because channel owners will take some sort of cut for the transactions happening through them (either a per transaction or a bulk channel fee, but less money for Amazon anyway). But . If Amazon cannot win enough strength to move the conversations to their own channels there can be a serious economic impact in its margins. the alternative of not being present on those channels if they are successful is losing the whole market, channel costs plus retail sales, and that is something Amazon cannot allow to happen

Amazon Anytime, can that work? (3) — What else to do?

Amazon may launch a messaging app, competing in Facebook’s domain. But does it stand a chance? , Amazon is working on “Anytime” an application, that would compete with Facebook’s WhatsApp or Messenger in the social communications space. According to recent information This is the second part in a(short) series of posts looking at several aspects of Anytime: Why is Amazon doing this? (keep reading! This post is about just *that*!) What looks interesting and what is a bad idea? What else should Amazon consider? What will Anytime do? The information available about Anytime functionality comes from the following list: (source TechCrunch) With this level of description it is very difficult to do a real product assessment, since we don’t really know anything about how customers will access to this features, how the interaction will be or what limitations or differentiations the experience will bring. Still the list covers known features from other applications, while adding several things that read different from what is available in the market or at least look intriguing. Let’s take a look at that, but be warned that the analysis will be 100% pure speculation. The Good So looking at that list I can see things that make sense for providing a new messaging app: It does You can obviously text, but also make voice and video calls, and apply further creativity to content sharing by having GIFs or emoji (it is unthinkable today to even considera a messaging app without that!), as well as filters for images and video. Users can share their location (although it doesn’t say if its the current location, allows location tracking in real time for a certain period, or shares it constantly, like ). Even @mentions and chat customization are available. Of course, making sense of all this with a proper UX will be critical, but let’s assume that Amazon Anytime will do good there. cover the basics expected from a messaging app today. Snap Maps Amazon insists in that you can use their product in several devices, including mobile and desktop (weirdly they mention desktop …). In fact the initial images also show a smart-watch icon, which shows that they are taking seriously this aspect. This follows the approach taken by Telegram, and moves away from the . It believe Amazon is aware and preparing for the , and it makes sense because they are pioneering the expansion of connected devices via their Echo line. In fact, this is not mentioned in the list, but why shouldn’t they offer Anytime for Echo? I will talk about this in . Multi-device. first current limitation in WhatsApp trend of the smartphone disintegration, which I have posted about before the next — and last — post on this series . The text mentions clearly the support for group calls and group video. In fact it does it twice: once when talking about group chats, and then again when describing the high quality of their calling experience. This is an increasingly popular communication model, , but that is also creating new kinds of experiences, like the one provided by . What approach will Amazon follow? The description points to something similar to what Messenger does, as it puts group video in the context of a previous text chat, but there is no real information there. Depending on how they design this, it can be the difference between a success or just another feature crammed into a busy product. Let’s give Amazon the benefit of the doubt for the moment. Real time communications for groups available in other apps like Facebook Messenger HouseParty, which is not based on “calling”, but on push-presence Facebook Skype Add-ins may be similar to the group activities planned for Anytime Ordering food or splitting a bill? That sounds interesting. It definitely walks the path toward making messaging a platform, which ties nicely into the next feature: interacting with businesses. Again the question will be how they add this variety of features into a chat. My guess at the moment is that they will follow a model similar to the or the . They will allow developers to create small apps that will provide this kind of activity (bill splitting, polls, food ordering…) and users will be able to add them into conversations. Previous experiences with this model , but maybe Amazon has learned something from that can drive this differently. Group activities. iMessage apps from Apple add-ins that Skype includes in their latest version have not been wildly successful developers building Skills for Alexa And of course they left the best for the end. (“ ”), so of course this is a core feature in the product. And again, the question is how this will be built and what experience will be offered to users. Will you get a new conversation entry in your inbox with any new Amazon order, so that you can check order status and ask specific questions or guidance for returning items to the seller? Will you be able to chat with brands just by tapping a mention to them in a different conversation? Will you have a channel for your utility provider to discuss bills? Will you get advertisements from products in the form of unsolicited chats? ( ) And while this will be and important focus on the new product, it is more important to realize that — from the user’s point of view — chatting with business is just a side use case. Amazon Anytime is presented as a messaging application to talk with your , and in which you can chat with businesses. So while Amazon has their biggest interest in this last aspect, it is the rest of the experience that needs to be great for that business model to be viable. Chat with businesses. The previous post in this series was about why the real goal for Amazon was to enable Anytime as an eCommerce channel and even shop! they better not! friends also The Bad And while all of the things discussed until now made sense (pending to see how they are executed) a couple of them sound just weird. First let’s look at — what does it mean (typos notwithstanding) that user can encrypt “ ”. It sounds to me that this points to an “insecure by default” approach, in which conversations will not provide full end-to-end encryption and just allow the activation of secure modes or obfuscation of specific messages. In particular the “bank account details” mention sounds too concrete, linking at once the aspirations for Amazon with the feeling that the rest of the conversation would not be secure. This kind of reminds me to , that shows a 1:1 relation to Anytime and Alexa in Amazon’s side. It also feels related to the group activities feature, that may require sharing elements of conversations with some cloud services to provide the expected value, like suggesting a pick up or destination place for a ride from a conversation. And it also is reminiscent of recent news about in certain circumstances, which may be required for the technology to evolve and perform as expected, but reinforces the ongoing debate about convenience vs. privacy. Amazon will have to provide a lot more of information about how they will treat user’s conversations in terms of privacy assurance, and what this will entail, but given that , this initially looks like an aspect for the “Bad” column. security important messages eCommerce Google’s approach with Allo and Google Assistant Amazon providing users’ audio from Alexa to developers the main contender on messaging has made privacy one of the main values they push for The first claim on the feature list is the least clear of them all and the one that . On the one hand, how does Amazon expect to have on it? Communication applications have a big issue in their growth stage, because to be useful both parties of the communication need to have downloaded the app and registered, and that means that in the early days (when no one knows the app exists and so haven’t downloaded it) these apps are pretty useless. To beat this, growth techniques entail getting the help from early users that would invite their friends by text or email (the really universal mechanisms that allow you to reach ) to get them to download and register. That is how the social graph keeps growing and, at some point, that “everyone’s on it” becomes more realistic (see WhatsApp in Europe and Latin America). This finding users by email or text is actually leveraging a pre-existing social graph: the address book in your phone. By getting users to identify using their phone number (that can be texted) or their e-mail address (that can be emailed), they are also providing a way to identify potential matches with contacts whose phone or email is registered in the user’s address book. Amazon is saying something different instead: “ ”, “ ”. Are they planning to build their social graph around nicknames like Skype or Twitter? That search-by-name approach may sounds simpler, but in reality is much harder when you are faced with names like jserna1977 or joeT_43, and provides a much slower graph growth than leveraging the address book in a phone. Maybe I’m reading too much into this, and this is just a marketing language approach to saying that it DOES use the user’s address book so they don’t need to bother with phone numbers (since they are already there, indexed by name)… but the service will be actually using phone numbers behind the scenes. Even if that is the case, the “everyone’s on it” may be an aspiration but is definitely misleading (as of today, no-one’s on it!), and creates an illusion of universal communication tool which is an almost impossible claim. That is bad. Really? “Everyone’s on it”? gives me a bad feeling everyone everyone No numbers here just using their name The Ugly The ugly part is that a single item in the “Bad” list outweighs everything in the “Good” one. Social Communication applications, but specially messaging ones, are not succeeding based on the number of features but on the size of their engaged social graph. Sometimes a single (great) feature can push this, and this was the basis of the original growth in SnapChat and is now driving other products like HouseParty. But an aggregation of features, most of which seem to be available elsewhere, will not make Anywhere a success. Why will they download it and register to talk with friends if they are already talking with them via ten other apps? What is the hook? Why would users switch from their existing messaging apps to use Amazon’s Anytime? Yes, in “Anytime wish-list” there are lots of things that WhatsApp does not do today. In fact , specifically and . But there are other applications out there that do those things, and while they are getting some traction, they are not displacing utilitarian conversations, or at least not in numbers that make them a channel more attractive for business transactions. I have already discussed in the past that WhatsApp should consider doing some to avoid being disrupted group real time multi-device support And that is the key conversation. If we consider that we need to look at what businesses are interested in. And what they want is to be able to reach their customers and that their potential customers can reach them. So Anytime will start to be valuable once they have an audience of millions in the platform, and , Amazon’s messenger initiative will not be the first choice for businesses. the real goal for Amazon here is to have businesses use Anytime to interact with their customers (and pay Amazon in the process) as long as Facebook Messenger and WhatsApp have 1.2+ billion engaged users There are lots of open questions here, like what kind of tools will Amazon provide to these businesses and how will they compare to the ones that WhatsApp is not even offering yet (a lot to speculate). It is possible that Amazon’s platform will be much more appealing, and that may help them gather momentum with business even with a reduced audience, but in the end the fundamental metric that will be how many customers for an specific business’ market are in Amazon Anytime vs. in other competing channels. And I can see no specific differential advantage in the list of features that would drive users to Amazon un a significant way. And on top of that, if Amazon finds that mythical “silver bullet” for growth, they still have the risk of having that . same feature rapidly cloned by Facebook in their products to neutralize it The Key So to summarize, the key aspect that is critical for Amazon in this space is they must create: something with enough differentiation and value for customers that they would be willing to replace their current conversations in WhatsApp or Facebook with new ones in Anytime and this differentiation should be built in some way that it cannot be simply copied and added into WhatsApp or/and Facebook Messenger (and/or even Instagram!) . For this second point, the best way to do this should be leveraging some asset that Amazon has and that Facebook cannot get access to easily. Maybe the tools and relationships in Amazon’s marketplace will make it so easy for vendors to create messaging channels than they will encourage their own buyers to use Anytime for their support and communications. Maybe shows on Amazon Prime Video will create content channels in Anytime that will allow interaction with the shows themselves in real time, and this will make it attractive enough for viewers. Maybe the Anytime’s experience in the Echo device line will help bootstrap the growth and then keep attracting users. It is too early to say, but without some catalyst for growth that can be controlled by Amazon, building the capilarity in the network required for a successful Social Communications product at the scale required to enable the business goals that Amazon has will be nearly impossible. But how does this fit with their Alexa Communication Services strategy? And, could Amazon try something different to defend themselves from the risk of eCommerce in chats? Well that is what I will talk about in the next (and final) post in this series . You can also read the previous post in this series , in which I look at the key reason why Amazon is aiming at the messaging space.

Amazon Anytime, can that work? (2) — The Good, the Bad and the Ugly

Amazon may launch a messaging app, competing in Facebook’s domain. But does it stand a chance? It feels like it was just a month and a half ago that , and what their next steps could be. was for Amazon to use this service to directly compete in the Social Communications space, offering an alternative to , Messenger, etc. I was talking about Amazon launching their Alexa Calling & Messaging service One of the strategic options that I considered then WhatsApp Facebook I then said that I thought this was probably not the best approach for Amazon, but now information has surfaced pointing to a new product called Amazon Anytime that would be exactly that. (source TechCrunch) According to this information, Amazon Anytime would be a full social communications offering, with multi-device focus (see the smartwatch icon in the image above?) and allowing texting, calling, video, group communications of all these categories and interaction with businesses. At this point it is unclear whether this is a real product or a research initiative by Amazon, trying to gather insights before defining what their actual product should be, if any. So, is this now a good idea? I will take a look at this in a (short) series of posts that will cover: (keep reading! This post is about just *that*!) Why is Amazon doing this? What looks interesting and what is a bad idea? What else should Amazon consider? Why is Amazon doing this? Let’s start with the most basic question, about what could be Amazon’s goal for moving into this space. Nowadays social communication services are free for end users, and monetization comes (or is expected) fundamentaly from advertising. This is the obvious case for Facebook social network, but it is also the path being followed by . This could be an interesting approach for Amazon too, a company not usually related with the advertising business, but that is . products like Facebook Messenger increasingly pushing into this space Advertising may become a part of Anytime at some point, but I don’t think this is the main reason for Amazon to consider launching this app, because it is still a relatively small business for them. . I believe this is a protective — or at least exploratory — approach to face an incoming risk to their core activity: eCommerce retail operations Messaging as an eCommerce platform Facebook as the incumbent, but also other messaging players (like Google simultaneously including Google Assistant in Allo, while hedging its bet supporting telcos with their RCS initiative), are exploring the concept of the messaging/communication apps as engagement points that can be leveraged for eCommerce. Their are just the technological reflection of their actual goal: driving economic transactions through messaging apps, and getting some kind of fee in the process. , and while there is no evidence that they will provide chatbots, the key aspect is that the value of just enabling the channel between a business and their customers can be huge. These players are trying to replicate the success in China of WeChat, which has been able to become , that . efforts in pushing businesses to interact with their customers via chatbots WhatsApp is clearly focusing its monetization efforts in the offering for business the center of the economic lives for many users use the chat app for almost any kind of transaction So with this context, thinking that consumers may shift their buying behaviors to directly interacting with brands and stores via chats, we get a good insight on why Amazon could be worried and try to grab some kind of control over this channel. Now the question is whether a new app can really help them here. In my next post I will look at what looks interesting (and what looks just bad) from the information that has been shared until now about Amazon Anytime.

Amazon Anytime, can that work? (1) — Why?

Since the emergence of generative AI, our work has undergone a significant transformation, and we need to adapt to this change. In the past, we could spend countless hours performing complex tasks to achieve a particular outcome. However, with generative AI tools, somebody on the other side can complete the same task in less time. Generative AI is not intended to replace the workforce or substitute for human intelligence. Instead, it serves as a means of enhancing our decision-making abilities by offering proposed solutions. Welcome to the era of generative AI! Amazon Q This tool is a big player in the software development industry and has been trained using billions of lines of code, using the proposed code can help us make better decisions and boost our productivity, allowing us to save time and achieve great results. This code companion supports a set of languages such as: Python
Java
Java script
Typescript
C #
and for code completion:
Go
C++
Shell
Kotlin
SQL
and for the most-supported languages in Infrastructure as Code (IaC) :
YAML (AWS cloud formation)
JSON (AWS cloud formation)
HCL (Terraform)
CDK (Typescript, Python)
Is the AI coding companion worth using for network engineers and developers? Infrastructure as code (IaC) IaC is a ubiquitous topic in the tech industry. It's mentioned in conferences, meetups, and online blogs.
thanks to the managing and provisioning of infrastructure through code instead of through manual processes, developers, and network engineers can work effectively and deliver high-quality services anytime wherever they are by collaborating easily for better results. The developer and network engineer's dilemma We all have industry-specific skills, but mastering everything in tech is difficult. Excitement and concerns surround the potential of AI.
The security concerns associated with AI arise because not all developers possess the security skills required for networking engineering or software development.
Network engineers may accidentally deploy vulnerable scripts that hackers can exploit. Developers can create apps to manage infrastructures, but if they do not follow a security-by-design approach in their software development lifecycle, their products can pose significant security concerns. Companies relying on such products may suffer reputational damage and even go bankrupt due to security breaches.
Amazon Q is a huge opportunity for network engineers and developers in the generative AI age. Where the acceleration will happen Network engineers and developers can improve their productivity by leveraging existing solutions (scripts) rather than reinventing the wheel.
the scanning provided by Q helps detect vulnerable code. Network engineers will save time by automating infrastructure deployment.
Q is an AI companion for junior engineers and developers. It accelerates their learning and helps with tasks they may find challenging.
Q has great potential for troubleshooting, as it is trained on billions of lines of code, surpassing expectations. A day with Amazon Q As a cloud engineer, I wanted to ask Q some questions for the first time as a user, here they are I asked Q what is Elastic Kubernetes Services (EKS) and here is the answer! The answer is synthetized and gives some links to the documentation, with such experience we can improve skills better and accelerate infrastructure as code with a wealth of knowledge at our fingertips. Explaining a terraform script Amazon Q explained the terraform script with details and documentation to AWS, with such experience, it’s easy to understand some scripts quickly and we can gain more time. Asking for secure coding practices The script is a snippet to provision an EC2 instance, the goal is to ask Q secure coding practices before provisioning the instance. Such experience allows developers and network engineers to improve the script before it goes into production. Conclusion In the era of generative AI, we have the opportunity to improve our learning and achieve greater results. Those who insist on reinventing the wheel cannot keep pace with teams that prioritize agility. Additionally, working with infrastructure as code is challenging and demands skilled teams to maintain high-quality infrastructures. With AI, we have an excellent opportunity to speed up infrastructure as code. We don't need to know everything; the AI will handle the rest! Since the emergence of generative AI, our work has undergone a significant transformation, and we need to adapt to this change. In the past, we could spend countless hours performing complex tasks to achieve a particular outcome. However, with generative AI tools, somebody on the other side can complete the same task in less time. Generative AI is not intended to replace the workforce or substitute for human intelligence. Instead, it serves as a means of enhancing our decision-making abilities by offering proposed solutions. Welcome to the era of generative AI! Amazon Q This tool is a big player in the software development industry and has been trained using billions of lines of code, using the proposed code can help us make better decisions and boost our productivity, allowing us to save time and achieve great results. This code companion supports a set of languages such as: Python Java Java script Typescript C # and for code completion: Go C++ Shell Kotlin SQL and for the most-supported languages in Infrastructure as Code (IaC) : YAML (AWS cloud formation) JSON (AWS cloud formation) HCL (Terraform) CDK (Typescript, Python) Is the AI coding companion worth using for network engineers and developers? Python Java Java script Typescript C # and for code completion: Go C++ Shell Kotlin SQL and for the most-supported languages in Infrastructure as Code (IaC) : YAML (AWS cloud formation) JSON (AWS cloud formation) HCL (Terraform) CDK (Typescript, Python) Is the AI coding companion worth using for network engineers and developers? Infrastructure as code (IaC) IaC is a ubiquitous topic in the tech industry. It's mentioned in conferences, meetups, and online blogs. thanks to the managing and provisioning of infrastructure through code instead of through manual processes, developers, and network engineers can work effectively and deliver high-quality services anytime wherever they are by collaborating easily for better results. IaC is a ubiquitous topic in the tech industry. It's mentioned in conferences, meetups, and online blogs. thanks to the managing and provisioning of infrastructure through code instead of through manual processes, developers, and network engineers can work effectively and deliver high-quality services anytime wherever they are by collaborating easily for better results. The developer and network engineer's dilemma We all have industry-specific skills, but mastering everything in tech is difficult. Excitement and concerns surround the potential of AI. The security concerns associated with AI arise because not all developers possess the security skills required for networking engineering or software development. Network engineers may accidentally deploy vulnerable scripts that hackers can exploit. Developers can create apps to manage infrastructures, but if they do not follow a security-by-design approach in their software development lifecycle, their products can pose significant security concerns. Companies relying on such products may suffer reputational damage and even go bankrupt due to security breaches. Amazon Q is a huge opportunity for network engineers and developers in the generative AI age. We all have industry-specific skills, but mastering everything in tech is difficult. Excitement and concerns surround the potential of AI. The security concerns associated with AI arise because not all developers possess the security skills required for networking engineering or software development. Network engineers may accidentally deploy vulnerable scripts that hackers can exploit. Developers can create apps to manage infrastructures, but if they do not follow a security-by-design approach in their software development lifecycle, their products can pose significant security concerns. Companies relying on such products may suffer reputational damage and even go bankrupt due to security breaches. Amazon Q is a huge opportunity for network engineers and developers in the generative AI age. Where the acceleration will happen Network engineers and developers can improve their productivity by leveraging existing solutions (scripts) rather than reinventing the wheel. the scanning provided by Q helps detect vulnerable code. Network engineers will save time by automating infrastructure deployment. Q is an AI companion for junior engineers and developers. It accelerates their learning and helps with tasks they may find challenging. Q has great potential for troubleshooting, as it is trained on billions of lines of code, surpassing expectations. Network engineers and developers can improve their productivity by leveraging existing solutions (scripts) rather than reinventing the wheel. the scanning provided by Q helps detect vulnerable code. Network engineers will save time by automating infrastructure deployment. Q is an AI companion for junior engineers and developers. It accelerates their learning and helps with tasks they may find challenging. Q has great potential for troubleshooting, as it is trained on billions of lines of code, surpassing expectations. A day with Amazon Q As a cloud engineer, I wanted to ask Q some questions for the first time as a user, here they are I asked Q what is Elastic Kubernetes Services (EKS) and here is the answer! The answer is synthetized and gives some links to the documentation, with such experience we can improve skills better and accelerate infrastructure as code with a wealth of knowledge at our fingertips. Explaining a terraform script Amazon Q explained the terraform script with details and documentation to AWS, with such experience, it’s easy to understand some scripts quickly and we can gain more time. Asking for secure coding practices The script is a snippet to provision an EC2 instance, the goal is to ask Q secure coding practices before provisioning the instance. Such experience allows developers and network engineers to improve the script before it goes into production. Conclusion In the era of generative AI, we have the opportunity to improve our learning and achieve greater results. Those who insist on reinventing the wheel cannot keep pace with teams that prioritize agility. Additionally, working with infrastructure as code is challenging and demands skilled teams to maintain high-quality infrastructures. With AI, we have an excellent opportunity to speed up infrastructure as code. We don't need to know everything; the AI will handle the rest!

Generative AI: Can we Accelerate Infrastructure as Code With Amazon Q?

We’re living in a pandemic of data breaches. More than 17 billion personal records were exposed last year, and 2024 has begun with a string of several high-profile back-to-back breaches in the first quarter, including data exposure of millions of AT&T account holders. Big Tech companies are in the crosshairs, too, facing mounting criticism from government officials calling for urgent reform. Even the open-source software supply chain is under threat from social engineering campaigns looking to compromise maintainer projects. ‘Social engineering’ is the key term here because it’s not software vulnerabilities that enterprises should be worried about. Those only make up 5% of breaches, while 68% involve the human element. How can this be? And what should companies do about it? The doors we open for hackers – and how to close them Exotic and sophisticated zero-day attacks and vulnerability exploits may garner the bulk of attention from the press, CISOs, and security teams, but the reality is that today’s cybersecurity tools are becoming exceedingly efficient at preventing and remediating these attacks. Hackers know this. They’re not going after software vulnerabilities. They’re attacking identity because it’s far cheaper and easier to exploit or force human error. So, they target credentials such as passwords, browser cookies, and private API keys. The data says it all, really: a Verizon report proves these credentials show up in 86% of security breaches related to web-based applications and platforms. Obtaining these credentials is how attackers do the most damage with minimal ease. Sometimes, these credentials are shared a little too freely. Other times, a shocking amount goes unused. The point is that organizations have lost control of their credentials, and the result is a growing fragmentation of identities across increasingly complex technology stacks. Those stacks are filled with layers that manage security in different ways, from Kubernetes clusters to Linux servers, copious amounts of specialized databases, IoT, cloud APIs, etc. It gets even more convoluted on a granular level once you’re inside a cloud account. If you have three Windows servers and seven Linux servers, each of those also governs its own login credentials. If you’ve got a multi-cloud setup with both AWS and Azure, those companies also track identity in different ways. In the quest for greater efficiency, DevOps engineers are even splitting cloud-native applications into smaller micro-services, each needing its own identity. Each of these layers opens yet another door for attackers to enter. If you’re an enterprise operating with more DevOps and cloud infrastructure, you’re inevitably going to add even more layers to the stack. More layers mean more doors. In other words, the mere presence of secrets, such as private keys, API keys, passwords, or even browser cookies, should be seen as a vulnerability waiting to be exploited in an identity attack. Stop using secrets for access purposes The problem isn’t the technology itself, though, but human behavior. Any time you create more doors, you’re increasing the probability of human error. So, how do you fix these data breaches? The first step is to consolidate all identities. All identities - including people and machines like servers, laptops, bots, databases, microservices, etc. – must be united into an inventory that provides a single source of truth. The second step is to make these identities impossible to impersonate or “steal”, effectively making the infrastructure security immune to human mistakes. To do this, minimize or eliminate the reliance on secrets for authentication purposes. As a rule, your identity should also never ever be presented as information. The only way to prevent data theft on a catastrophic scale is to remove all static credentials and standing privileges and instead deploy strong authentication with cryptographic identity. In practice, this means basing identity on three-point criteria that include 1) a user’s specific device, 2) a biometric marker, and 3) a personal identification number (PIN). In theory, this is exactly how the iPhone works: the biometric marker is facial recognition, the personal identification number is your PIN code, and the Trusted Platform Module (TPM) chip inside the phone is what governs the ‘machine identity.’ But credentials – or doors, if you will – are just half the story. Observability isn’t enough The thing about human error is that it’s blind to the quality of your cybersecurity and observability tools. It only takes one human to make a mistake by granting access to the wrong people. This already happens. As we learned earlier this year, Google Kubernetes Engine admins are not immune to misunderstanding the significance and scope of default user groups and assigning dangerous permissions to them. The cybersecurity industry has spent a disproportionate amount of time and money on observability. Companies are acquiring and maintaining tools to respond to threats rather than fix enforcement to proactively protect infrastructure. One reason companies tend to be put off by fixing enforcement is the aforementioned complexity of modern technology stacks. The natural assumption is you need competent teams who can configure every single layer with its own authentication, its own authorization, its own encryption, and its own audit. The smarter solution here would be for the cybersecurity industry to embrace a new paradigm for modernizing secure access to infrastructure. This paradigm has to be built on embracing mechanisms that unify all access within a single control point for authentication and authorization. Most enterprises sorely need (and yet lack) this mechanism as a front-end to all of their disparate infrastructure. Access should only ever be granted based on tasks, and only the minimum required privileges should ever be granted. These should then be de-provisioned immediately afterward. This concept of on-demand least-privileged access then needs to be applied to both human and non-human machine and service accounts. In other words, every company should be able to easily enforce the policy that developers should never have access to production data. However, without unified access controls, this will remain a sci-fi concept for many cybersecurity professionals. Unifying access controls isn’t just helpful in the proactive sense. If a data breach does eventually occur, a centralized view of all the access relationships attributed to a user or resource is essential for purposes like quickly revoking unwanted access or auditing. This is how enforcement and observability can be combined for agility. And if you’ve already assigned cryptographic identity beforehand to each individual user or resource, you’ve now associated the actual human user with each action. This means assigning the right permissions to the right people becomes a much easier task. Defend against human behavior There are, of course, positive signs of technology leaders in the industry taking data breaches very seriously. Microsoft has pledged to shore cloud vulnerabilities, prevent credentials from being stolen, and automatically enforce multi-factor authentication for employees. Any efforts to embrace stronger authentication and  cryptographic measures should be commended. If cybersecurity is going to ‘win,’ though, enterprises have to understand that stopping data breaches isn’t about defending against viruses or ultra-sophisticated hacking techniques. It’s about defending against human behavior that exposes infrastructure to data leaks. That’s the mindset that needs to change. Unified access control, paired with zero trust, must be the foundation for modernizing secure access. We’re living in a pandemic of data breaches. More than 17 billion personal records were exposed last year , and 2024 has begun with a string of several high-profile back-to-back breaches in the first quarter, including data exposure of millions of AT&T account holders. 17 billion personal records were exposed last year Big Tech companies are in the crosshairs , too, facing mounting criticism from government officials calling for urgent reform. Even the open-source software supply chain is under threat from social engineering campaigns looking to compromise maintainer projects. Big Tech companies are in the crosshairs Even the open-source software supply chain is under threat ‘Social engineering’ is the key term here because it’s not software vulnerabilities that enterprises should be worried about. Those only make up 5% of breaches , while 68% involve the human element. How can this be? And what should companies do about it? make up 5% of breaches The doors we open for hackers – and how to close them The doors we open for hackers – and how to close them Exotic and sophisticated zero-day attacks and vulnerability exploits may garner the bulk of attention from the press, CISOs, and security teams, but the reality is that today’s cybersecurity tools are becoming exceedingly efficient at preventing and remediating these attacks. Hackers know this. They’re not going after software vulnerabilities. They’re attacking identity because it’s far cheaper and easier to exploit or force human error. So, they target credentials such as passwords, browser cookies, and private API keys. The data says it all, really: a Verizon report proves these credentials show up in 86% of security breaches related to web-based applications and platforms. 86% of security breaches Obtaining these credentials is how attackers do the most damage with minimal ease. Sometimes, these credentials are shared a little too freely. Other times, a shocking amount goes unused . The point is that organizations have lost control of their credentials, and the result is a growing fragmentation of identities across increasingly complex technology stacks. Those stacks are filled with layers that manage security in different ways, from Kubernetes clusters to Linux servers, copious amounts of specialized databases, IoT, cloud APIs, etc. a shocking amount goes unused It gets even more convoluted on a granular level once you’re inside a cloud account. If you have three Windows servers and seven Linux servers, each of those also governs its own login credentials. If you’ve got a multi-cloud setup with both AWS and Azure, those companies also track identity in different ways. In the quest for greater efficiency, DevOps engineers are even splitting cloud-native applications into smaller micro-services, each needing its own identity. Each of these layers opens yet another door for attackers to enter. If you’re an enterprise operating with more DevOps and cloud infrastructure, you’re inevitably going to add even more layers to the stack. More layers mean more doors. In other words, the mere presence of secrets, such as private keys, API keys, passwords, or even browser cookies, should be seen as a vulnerability waiting to be exploited in an identity attack. Stop using secrets for access purposes Stop using secrets for access purposes The problem isn’t the technology itself, though, but human behavior. Any time you create more doors, you’re increasing the probability of human error. So, how do you fix these data breaches? The first step is to consolidate all identities. All identities - including people and machines like servers, laptops, bots, databases, microservices, etc. – must be united into an inventory that provides a single source of truth. The second step is to make these identities impossible to impersonate or “steal”, effectively making the infrastructure security immune to human mistakes. To do this, minimize or eliminate the reliance on secrets for authentication purposes. As a rule, your identity should also never ever be presented as information. The only way to prevent data theft on a catastrophic scale is to remove all static credentials and standing privileges and instead deploy strong authentication with cryptographic identity. In practice, this means basing identity on three-point criteria that include 1) a user’s specific device, 2) a biometric marker, and 3) a personal identification number (PIN). In theory, this is exactly how the iPhone works: the biometric marker is facial recognition, the personal identification number is your PIN code, and the Trusted Platform Module (TPM) chip inside the phone is what governs the ‘machine identity.’ But credentials – or doors, if you will – are just half the story. Observability isn’t enough Observability isn’t enough The thing about human error is that it’s blind to the quality of your cybersecurity and observability tools. It only takes one human to make a mistake by granting access to the wrong people. This already happens. As we learned earlier this year, Google Kubernetes Engine admins are not immune to misunderstanding the significance and scope of default user groups and assigning dangerous permissions to them . misunderstanding the significance and scope of default user groups and assigning dangerous permissions to them The cybersecurity industry has spent a disproportionate amount of time and money on observability. Companies are acquiring and maintaining tools to respond to threats rather than fix enforcement to proactively protect infrastructure. One reason companies tend to be put off by fixing enforcement is the aforementioned complexity of modern technology stacks. The natural assumption is you need competent teams who can configure every single layer with its own authentication, its own authorization, its own encryption, and its own audit. The smarter solution here would be for the cybersecurity industry to embrace a new paradigm for modernizing secure access to infrastructure. This paradigm has to be built on embracing mechanisms that unify all access within a single control point for authentication and authorization. Most enterprises sorely need (and yet lack) this mechanism as a front-end to all of their disparate infrastructure. Access should only ever be granted based on tasks, and only the minimum required privileges should ever be granted. These should then be de-provisioned immediately afterward. This concept of on-demand least-privileged access then needs to be applied to both human and non-human machine and service accounts. In other words, every company should be able to easily enforce the policy that developers should never have access to production data. However, without unified access controls, this will remain a sci-fi concept for many cybersecurity professionals. Unifying access controls isn’t just helpful in the proactive sense. If a data breach does eventually occur, a centralized view of all the access relationships attributed to a user or resource is essential for purposes like quickly revoking unwanted access or auditing. This is how enforcement and observability can be combined for agility. And if you’ve already assigned cryptographic identity beforehand to each individual user or resource, you’ve now associated the actual human user with each action. This means assigning the right permissions to the right people becomes a much easier task. Defend against human behavior Defend against human behavior There are, of course, positive signs of technology leaders in the industry taking data breaches very seriously. Microsoft has pledged to shore cloud vulnerabilities, prevent credentials from being stolen, and automatically enforce multi-factor authentication for employees. Any efforts to embrace stronger authentication and  cryptographic measures should be commended. If cybersecurity is going to ‘win,’ though, enterprises have to understand that stopping data breaches isn’t about defending against viruses or ultra-sophisticated hacking techniques. It’s about defending against human behavior that exposes infrastructure to data leaks. That’s the mindset that needs to change. Unified access control, paired with zero trust, must be the foundation for modernizing secure access.

Stories, News & Mentions about ANYTIME

Anytime’s Stories on HackerNoon